Affiliate-level restrictions on listed entities under BIS / EAR: explained

A technology exporter reviews its customer list. The end-user appears clean. No name matches the Entity List (BIS's register of parties requiring a licence or subject to a per-se denial policy for exports, re-exports, and in-country transfers of items subject to the Export Administration Regulations). The deal proceeds. Six months later, a due-diligence review reveals that the customer is a subsidiary of a listed group. The shipment has already left. This is the screening gap that surfaces only after a breach – and under the BIS / EAR, it carries real consequences.

Affiliate-level restrictions on listed entities under BIS / EAR rules arise because the Entity List, the Denied Persons List, and other BIS control lists extend their reach beyond the named party to affiliates and subsidiaries in specific circumstances. The Bureau of Industry and Security administers these controls under the Export Administration Regulations, and the analysis turns not on the name that appears in your screening tool but on ownership, operational links, and the risk that a controlled item reaches a restricted end-user through an intermediate entity. As of January 2026, this area sits at the intersection of intensifying enforcement, new BIS guidance on affiliated-entity liability, and a pending rule on ownership-based restrictions that has already been postponed once.

This briefing covers who administers the rules, the legal basis and scope, the key prohibitions, the ownership and control test as BIS applies it, the licensing route, reporting and record-keeping obligations, the enforcement posture, and how these rules interact with OFAC, OFSI, and the EU.

Who administers affiliate-level restrictions and what is their legal basis?

The Bureau of Industry and Security, a component of the US Department of Commerce, administers the Export Administration Regulations under authority derived principally from the Export Control Reform Act and the International Emergency Economic Powers Act. The EAR govern the export, re-export, and in-country transfer of items that appear on the Commerce Control List as well as items that are subject to the EAR but not specifically listed – the so-called EAR99 category.

Affiliate-level restrictions are not a separate legal instrument. They arise from the combination of three mechanisms. First, the Entity List names specific persons and imposes licence requirements or per-se denial policies on dealings with them. Second, BIS guidance and enforcement practice make clear that the controls follow the listed party's operational structure, not just its legal name. Third, the Foreign Direct Product rules (FDP rules) extend jurisdiction to foreign-produced items that are the direct product of controlled US technology or software, meaning that a foreign affiliate of a listed entity that manufactures items using controlled US inputs can itself be drawn within US jurisdiction.

The practical effect is that an exporter who deals with what appears to be a clean counterparty may still violate the EAR if that counterparty is a controlled affiliate of a listed person. In our practice, this scenario arises most frequently in group structures where the listed parent sits one or two levels above the transacting entity.

What is the scope of BIS controls on listed entities and their affiliates?

The EAR apply to all items subject to its jurisdiction, regardless of where a transaction takes place, when a US-origin or US-technology nexus exists. Items are classified by an ECCN (Export Control Classification Number under the Commerce Control List), and the applicable controls – including licence requirements and available exceptions – depend on that classification, the destination, the end-use, and the end-user.

When a party appears on the Entity List, a validated licence is typically required for exports, re-exports, and in-country transfers of any item subject to the EAR to that party, and licence exceptions are generally unavailable. The restriction attaches to the named party. The affiliate-level question arises when a transaction involves an entity that is not itself named but that is operationally or structurally connected to a named entity.

BIS assesses this through several lenses. Ownership is the most direct: a company owned 50 percent or more by a listed entity is treated with significant suspicion, and a pending rule – currently scheduled but already postponed once – would formalise ownership-based restrictions that extend Entity List consequences to affiliates meeting that threshold. Operational integration is the second lens: where a non-listed affiliate acts as a procurement front, re-routes controlled technology, or fulfils orders on behalf of a listed parent, BIS treats the transaction as one with the listed party. A third lens is end-use: the military end-use and end-user controls administered by BIS apply to specified destinations and can catch a transaction with an affiliate of a military end-user even where the affiliate itself is not listed.

Does your screening process assess ownership chains, or only the counterparty's own name? That question is where most compliance gaps begin.

What does BIS / EAR prohibit in relation to affiliate-level restrictions on listed entities?

The core prohibition is the export, re-export, or in-country transfer of an item subject to the EAR to a party on the Entity List without a validated licence when none of the applicable licence exceptions is available. The affiliate-level dimension extends this prohibition in three ways.

First, facilitation by US persons is prohibited. A US person who facilitates a transaction that a non-US party could not lawfully perform without a licence is itself in violation. This matters for affiliates: a US parent that arranges financing, logistics, or technical support for an export by a foreign affiliate to a listed entity's purchasing arm may be facilitating a prohibited transaction.

Second, the FDP rules can make a foreign-produced item subject to the EAR if it is the direct product of controlled US technology or software, or if it is produced by a plant that is itself such a product. When a listed entity or its affiliate uses controlled US technology in a manufacturing process and the output is then transferred to a third party, the analysis must follow the item's origin, not just the identity of the transferor.

Third, a deemed export occurs when controlled technology or source code is released to a foreign national within the United States. Where an affiliate has employees who are nationals of a country subject to heightened controls, that release may itself require a licence. In group structures with shared engineering teams, this is a frequently overlooked exposure.

None of these prohibitions requires knowledge or intent for a civil violation to arise. The EAR, like OFAC's civil-penalty regime, operates on a strict-liability basis for most civil charges. An exporter who did not know its counterparty was an affiliate of a listed entity is not automatically protected.

How does the ownership and control test work under the EAR, and how does it compare with OFAC, OFSI, and the EU?

Under the EAR, the operative question for affiliate-level restrictions is whether the facts establish a sufficient connection between the counterparty and a listed entity to attract the listed entity's restrictions. Ownership is assessed directly, indirectly, and in the aggregate. A significant minority holding – below the 50 percent formal threshold – is treated as a red flag that requires enhanced due diligence rather than a safe harbour.

This differs from OFAC's 50 percent rule, which is mechanical: an entity owned 50 percent or more in the aggregate by one or more blocked persons is itself treated as blocked, and the test does not turn on control. The OFAC rule produces a binary outcome; the EAR analysis is more contextual and fact-specific.

Under OFSI and the EU, the test is an ownership and control standard that looks beyond formal shareholdings to actual influence. UK case law holds that control must be actual, not theoretical. The EU asset-freeze prohibition extends to making funds or economic resources available, directly or indirectly, to or for the benefit of listed persons, which is a broader formulation than a pure ownership threshold. An EU court ruling has confirmed that control must be demonstrated by objective and sufficiently weighty evidence.

The practical divergence is significant for multinationals. A group structure that passes the OFAC 50 percent test (because no single listed person holds more than 49 percent) may still attract EU or UK controls through the control test, and may still attract EAR restrictions through the contextual analysis of operational integration. Where two regimes both apply, the stricter prohibition governs the conduct of a person subject to both; a compliance programme that maps only one regime will miss the overlap.

In our cross-border practice, we regularly advise clients who have correctly screened for OFAC purposes and then discovered, at the diligence stage of a transaction, that the EU or UK position is materially different. The lesson is that the screening tool must be calibrated to the most demanding applicable test, not the most familiar one.

What is the licensing route and are there available exceptions?

A validated licence from BIS is the primary route to lawfully exporting, re-exporting, or transferring in-country an item subject to the EAR to a listed entity or, in the affiliate-level context, to a party where the restrictions of a listed entity extend. BIS applies a case-by-case review standard for most licence applications, and for Entity List parties a per-se denial policy means that applications are presumptively refused.

Licence exceptions – standing authorisations that permit defined categories of transactions without a separate application – are generally unavailable when an Entity List party is involved. Eligibility is item-, end-use-, and destination-specific, and the restriction on using exceptions for Entity List parties is explicit in BIS practice. This is a point of material difference from the OFAC general-licence system, where a general licence can, in some programmes, permit dealings with affiliates of designated persons for defined categories of activity.

Where a transaction genuinely warrants a licence application, the process involves a detailed submission covering the item's classification, the end-use, the end-user, and the ownership chain. Timelines for BIS licence review are not prescribed by statute in the way that OFSI's internal service standards are, and applications involving listed-entity affiliates will attract heightened scrutiny. In our experience, businesses that prepare a complete and well-documented application, including a transparent description of the affiliate relationship, are better positioned than those who attempt to minimise the disclosure.

What happens if a licence is refused? The applicant may request reconsideration and, ultimately, pursue the administrative and judicial review routes available under US administrative law. Those routes are resource-intensive and not time-compressed. Early legal advice on whether a transaction is structured to maximise the prospect of approval is always preferable to a post-denial challenge.

What are the reporting and record-keeping obligations?

The EAR impose record-keeping obligations on all parties to transactions involving items subject to the EAR. Records must be retained for five years from the date of the export, re-export, transfer, or related transaction. This covers shipping documents, licence applications and approvals, end-use certificates, and any screening records generated in connection with the transaction.

For affiliate-level situations, record-keeping is particularly important because the analysis of the affiliate relationship will need to be reconstructable if BIS later opens an inquiry. A contemporaneous record of the ownership search, the conclusion reached, and the basis for that conclusion is a material element of any voluntary self-disclosure or enforcement-defence posture.

Voluntary self-disclosure (VSD) – a disclosure to BIS of an apparent violation before the agency independently discovers it – is a recognised mitigating factor in the enforcement process. The EAR's VSD framework operates in a broadly similar way to OFAC's: a timely, complete, and accurate disclosure can reduce the severity of the outcome, though it does not guarantee any particular result. In our practice, the question of whether and when to make a VSD in an affiliate-level case is one of the most consequential decisions a compliance team faces, and it requires careful legal advice before the disclosure is submitted.

There is no BIS equivalent of OFSI's mandatory reporting obligation for knowledge or suspicion of designated persons. The US reporting regime is largely transactional and record-based rather than suspicion-driven. That said, if a business identifies an apparent violation, the interaction between BIS VSD practice and any parallel OFAC or DOJ exposure must be assessed before a disclosure strategy is finalised.

What is BIS's enforcement posture and what are the risk flags for affiliates?

BIS enforcement actions in the affiliate-level area have followed a consistent pattern: the agency focuses on transactions where the exporter had access to information – ownership records, corporate filings, public corporate structures – that should have prompted a closer look, but did not pursue it. The standard is not omniscience; it is reasonable diligence calibrated to the risk profile of the transaction.

The risk flags that BIS and its enforcement partners at DOJ treat as aggravating are well established. A counterparty that is incorporated in a jurisdiction through which controlled technology has previously been diverted is a primary indicator. A mismatch between the stated end-use and the counterparty's business profile is another. Unusual payment routing, requests to omit information from shipping documents, and changes to the ultimate consignee at a late stage all feature in enforcement records. In affiliate-level cases, a sudden change in the ownership or name of a counterparty shortly before a transaction is a red flag that should always trigger escalation.

A sharp change in trade flows to a neighbouring or transit jurisdiction is treated as a diversion indicator under BIS enforcement practice. Transit through a third country does not change an item's controlled status; the origin and end-use analysis follows the item, not the route. This principle applies with equal force to affiliate structures where a listed entity uses a geographically separate affiliate as a procurement conduit.

The statute of limitations for civil and criminal violations of IEEPA and TWEA was extended to 10 years in 2024, as currently in force – verify the effective date and scope before reliance. This extension materially changes the enforcement horizon and means that transactions completed years ago remain within BIS's reach. A compliance programme that treats old transactions as beyond scrutiny is not calibrated to current enforcement risk.

We have acted for exporters who identified affiliate-level exposure during internal audits of multi-year transaction books and who needed to assess the full scope of potential liability before deciding how to proceed. The length of the lookback required – and the number of transactions caught within it – is often the most significant practical issue in these matters.

When should a business involve sanctions and export-control counsel?

The myth that name screening alone is enough to meet the rules is persistent and consistently disproved by enforcement practice. Entity List compliance requires an assessment of the ownership chain, operational integration, end-use, and the FDP analysis for any item with a US-technology nexus. A compliance programme built solely around name matching against published lists will not catch the affiliate scenarios that BIS enforcement has repeatedly targeted.

Counsel should be involved at four points. First, before a new relationship is approved where the counterparty operates in a group with any listed entity connection, even a distant one. Second, when a transaction involves items with a high ECCN classification or items that are controlled for national security, proliferation, or military end-use reasons. Third, when an ownership review of an existing counterparty reveals a change in shareholding that may bring a listed entity into the picture. Fourth – and most urgently – when an apparent violation is identified and the business must decide whether to disclose, how to scope the disclosure, and how to manage parallel exposure under OFAC or the EU regime.

The position above covers the standard framework. Your facts – the item, the destination, the counterparty's group structure, and the regime in play – change the analysis. For an assessment of your exposure under the EAR and any parallel regimes, contact Calder & Vance at info@caldervance.com.

If an apparent violation has already been identified, or a licence application has been refused, an early review can preserve options that narrow with time. Contact us at info@caldervance.com for a confidential review.

Related practices

• Affiliate-level restrictions – BIS / EAR advisory service – licence strategy, ownership mapping, and enforcement-defence support for affiliated-entity exposure
• Aggregating holdings under OFAC: explained – how OFAC's 50 percent rule applies to layered ownership structures and where it diverges from the BIS and EU tests
• Blockchain analytics and OFAC screening – digital-asset screening obligations and the use of on-chain analysis in sanctions compliance

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.